Critical infrastructure security

How incident response changes when industrial control systems are involved: who has authority over the process, how to reach a safe state, when it is safe to isolate each kind of OT system, and how to recover controllers from known-good copies.

A plain-English explainer on Australia's Security of Critical Infrastructure (SOCI) Act: the sectors it covers, the positive security obligations, mandatory cyber incident reporting, the risk-management program requirement, and the enhanced obligations for systems of national significance. General information, not legal advice.

Booz Allen’s OT Cybersecurity Lab ran two unnamed frontier AI models against a model manufacturing plant — real PLCs, HMIs, a SCADA platform, a VFD/motor and a robotic arm. Across 8 controlled scenarios every objective was met; one run reached the control network in ~16 minutes; a model took admin control of a robotic arm and moved it. But a human approved every exploit and every physical action, some controls held, and the Cloud Security Alliance calls it a vendor-reported lab finding, not evidence of autonomous AI attacks in the field. A calm read of what it means for OT defenders — and what to do first.

Within days, two European grocery giants were hit by very different cyber incidents that ended the same way — empty fresh-food shelves. Albert Heijn (Ahold Delhaize) took its websites, apps and logistics systems offline after a cybersecurity incident, halting online deliveries and stalling distribution centres; in France, attackers hijacked Danfoss refrigeration controllers and cooked the fridges. One is an IT/logistics failure, the other OT sabotage. Here is what is confirmed, how they differ, and why food retail is now critical infrastructure.

CISA’s 2026 guidance recommends honeytokens, canary accounts and decoy systems to catch living-off-the-land attacks. A deployment roadmap with Sigma rules.

On 11–12 October 2026, attackers hijacked refrigeration controllers in hundreds of French supermarkets and forced defrost cycles that heated units toward 50°C, spoiling food across Intermarché, Carrefour, Monoprix, Leclerc, Coopérative U and Super U. CERT-FR confirmed compromises of Danfoss AK-SM and AK-SC controllers and told operators to disconnect them. Here is what is confirmed, what is still unverified, why refrigeration is OT, and the PlayCISO tools to check your own exposure.

An independent, defensive roundup of the major cyber incidents reported in July 2026 — the Fairlife/Coca-Cola ransomware shutdown, Clop's PTC Windchill data-theft campaign, the 12-million-record KDDI breach, Accenture's source-code incident, a coordinated OT attack on 30+ Minnesota water utilities, and the actively-exploited ColdFusion and Langflow flaws. Each item carries a status label (Confirmed / Claimed / Reported) and a subjective 1–10 severity read, with a defensive takeaway.